ci(publish): publish @hyperframes/sdk to npm

[vanceingalls]

Problem

@hyperframes/sdk is version-bumped but never published. scripts/set-version.ts includes packages/sdk in its PACKAGES list, so the SDK rides the shared version line (currently 0.6.112) — but .github/workflows/publish.yml's Publish packages step has a hardcoded publish_pkg list that omits the SDK. Result: @hyperframes/sdk@0.6.112 resolves to a 404 on npm, while core / player / engine / producer / studio / etc. all shipped at 0.6.112.

This blocks consumers (e.g. Pacific / AI Studio) from pnpm add @hyperframes/sdk — the editing engine can't be installed.

Fix

Add the one missing line to the publish list:

publish_pkg "@hyperframes/sdk" "@hyperframes/sdk"

(placed after @hyperframes/core, its runtime dep).

Nothing else gatekeeps it: set-version.ts already bumps it, scripts/verify-packed-manifests.mjs auto-discovers every dir under packages/ (so the SDK's packed manifest is already verified publish-safe), and CI already runs the SDK test suite. The SDK's package.json has publishConfig.access: public + files/main/types — release-ready.

Effect

• Future releases publish the SDK alongside the other packages.
• To backfill the current line now: after merge, run the Publish to npm workflow via workflow_dispatch with version 0.6.112 (tag v0.6.112 exists). The step is idempotent — every already-published package is skipped, so only @hyperframes/sdk@0.6.112 gets pushed.

🤖 Generated with Claude Code

[miga-heygen]

Clean, surgical fix. One line, right where it belongs. I verified all the claims:

1. set-version.ts already includes SDK — confirmed at line 33: "packages/sdk". The SDK rides the shared version line, so it's been getting bumped without being published. Ghost versions on npm.

2. Placement is correct — @hyperframes/sdk depends on @hyperframes/core ("@hyperframes/core": "workspace:*" in its package.json). Publishing it immediately after core ensures the dependency is on npm before the SDK hits pnpm publish. Good sequencing.

3. SDK's package.json is publish-ready — publishConfig.access: "public", files, main, types, conditional exports with dist/ paths all present. No blockers.

4. verify-packed-manifests.mjs already covers it — auto-discovers packages/*, so the SDK's packed manifest is already validated in CI. No gap there.

5. Idempotent backfill plan — the publish_pkg function checks npm view "${name}@${VERSION}" version before publishing and skips already-published packages. The workflow_dispatch backfill described in the PR body is safe; only the missing SDK version gets pushed.

No issues found. The fix is minimal, correctly ordered, and every supporting claim checks out.

LGTM — ready for stamp.

— Miga

[james-russo-rames-d-jusso]

Reviewed at HEAD 575ff13a.

Verdict: LGTM, stamp-ready.

Independently verified every claim in the PR body:

• ✅ Diff is exactly +publish_pkg "@hyperframes/sdk" "@hyperframes/sdk" at .github/workflows/publish.yml:128, placed right after @hyperframes/core (correct — SDK depends on core per packages/sdk/package.json dependencies).
• ✅ @hyperframes/sdk is genuinely a 404 on the npm registry — confirmed via npm view @hyperframes/sdk versions returning E404 Not Found - GET https://registry.npmjs.org/@hyperframes%2fsdk. No version of the SDK has ever shipped, despite set-version.ts PACKAGES list at scripts/set-version.ts including "packages/sdk".
• ✅ Idempotency claim holds. publish_pkg shell function at publish.yml:108-126 runs npm view "${name}@${VERSION}" version >/dev/null 2>&1 and returns 0 (skipping with ⏭️) if the version is already published. Re-running on v0.6.112 would push only @hyperframes/sdk@0.6.112; the other 8 packages already at 0.6.112 would skip cleanly.
• ✅ Auto-discovery in verify-packed-manifests.mjs works via readdirSync(PACKAGES_DIR) — the SDK's packed manifest is verified by CI on every PR.
• ✅ SDK is release-ready: publishConfig.access: "public", files: ["dist", "README.md"], exports map points at ./dist/index.js + ./dist/index.d.ts, build runs before publish via bun run build.

One minor nit (non-blocking):

PR body says the SDK's package.json has main/types — they're actually null at the top level; the modern publishConfig.exports[".] map at :main/:types is where it lives. Functionally correct (exports overrides main/types in modern Node), just slightly imprecise wording. No action needed.

Backfill execution note:

When you trigger Publish to npm via workflow_dispatch with version 0.6.112 after merge, the workflow will run all 9 publish_pkg calls; the 8 already-published packages skip via the npm view early-return, and only @hyperframes/sdk@0.6.112 actually pushes. The tag v0.6.112 already exists, so the SHA used by the publish step will match what shipped at that version of the other packages — keeping the SDK consistent with its @hyperframes/core runtime dep.

Review by Rames D Jusso

[miguel-heygen]

LGTM

[jrusso1020]

LGTM — stamp per Rames D Jusso's routing. 1-line addition of publish_pkg "@hyperframes/sdk" "@hyperframes/sdk" between @hyperframes/core and @hyperframes/engine in .github/workflows/publish.yml:128. RDJ's substance verification (@hyperframes/sdk 404 on npm registry, publish_pkg idempotency holds via the npm view early-return, dep ordering correct since @hyperframes/sdk depends on @hyperframes/core) matches the diff at HEAD 575ff13a. Once merged, the next workflow_dispatch on the existing release backfills only the missing SDK package without touching anything else.

Stamp by Rames Jusso (verification per Rames D Jusso's pass at SHA 575ff13a).